USN-3953-1 php7.0, php7.2 vulnerabilities

It was discovered that PHP incorrectly handled certain exif tags in JPEG images. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code...

DEBIAN-CVE-2019-11372

An out-of-bounds read in MediaInfoLib::FileTagsHelper::SynchedTest in Tag/FileTags.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash...

PT-2020-6249

Name of the Vulnerable Software and Affected Versions Ceph versions through 13.2.9 Description The issue is related to errors in POST requests with invalid XML tags, which can cause a NULL pointer exception and crash the RGW process. This can be exploited by a remote attacker to cause a denial of...

Mac-Focused Malvertising Campaign Abuses Google Firebase DBs

A malvertising group named VeryMal that targets Mac users has changed up its tactics, ditching steganography as its obfuscation technique. Instead, it’s using ad tags that fetch a payload from Google Firebase in order to redirect users to malicious pop-ups. Confiant estimates that close to 1...

Practical advice for earning higher Microsoft bounty awards

This year at the Nullcon International Security Conference I shared practical advice for how security researchers can maximize the impact of their security vulnerability submissions and earn higher bounty awards under the Microsoft Bounty Program. For those who couldn’t be there, I had two core...

MGASA-2019-0095 Updated libexif packages fix security vulnerability

It was found that specially crafted XIFIFDINTEROPERABILITY and EXIFIFDEXIF tags could be used for a denial of service CVE-2018-20030...

UBUNTU-CVE-2018-20030

An error when processing the EXIFIFDINTEROPERABILITY and EXIFIFDEXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources...

CVE-2018-20030

An error when processing the EXIFIFDINTEROPERABILITY and EXIFIFDEXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources...

Code injection

An error when processing the EXIFIFDINTEROPERABILITY and EXIFIFDEXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources...

ALPINE-CVE-2018-20030

An error when processing the EXIFIFDINTEROPERABILITY and EXIFIFDEXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources...

CVE-2018-20030

The CVE affects libexif 0.6.21, where processing EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags could be exploited to exhaust CPU resources, causing a Denial of Service. Multiple connected advisories note this as a fixed issue in newer libexif packages and recommend upgrading to patched release...

Denial Of Service (DoS)

ImageMagick is vulnerable to denial of service DoS attack. The attack exists due to the way certain Exif tags with a large components count are handled, allowing an attacker to pass a malicious image file causing an invalid memory access and crash...

HealthNode Hospital Management System 1.0 - SQL Injection

Exploit Title: HealthNode Hospital Management System 1.0 - SQL Injection Dork: N/A Date: 2019-01-13 Exploit Author: Ihsan Sencan Vendor Homepage: http://sunriseservices.biz/ Software Link: https://codecanyon.net/item/healthnode-hospital-management-system/22368747 Version: 1.0 Category: Webapps...

CVE-2018-6114

Incorrect enforcement of CSP for tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content security policy via a crafted HTML page...

UBUNTU-CVE-2018-6114

Incorrect enforcement of CSP for tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content security policy via a crafted HTML page...

CVE-2018-6114

Incorrect enforcement of CSP for tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content security policy via a crafted HTML page...

CVE-2018-6114

CVE-2018-6114: A vulnerability in Chromium/Blink allowed bypass of Content Security Policy via CSP enforcement failure for tags. Affected products include Google Chrome and Chromium (Blink engine). Root cause is CSP bypass in the rendering pipeline, enabling remote HTML crafted pages to bypass C...

CVE-2018-20030

An error when processing the EXIFIFDINTEROPERABILITY and EXIFIFDEXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources...

Open-Xchange (OX) App Suite SSRF Vulnerability (58874)

Open-Xchange OX App Suite is prone to a server-side request forgery SSRF vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cross-Site Scripting in react-dom

Affected versions of react-dom are vulnerable to Cross-Site Scripting XSS. The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by...